fraqtal/agentic-dev
Template
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
Files
aa138348a7cb44d7a2f1be0fbfadcdf393adae01
agentic-dev/docs/work/epics/ci-security-and-supply-chain/08-reviewer-prompt-update/_story.md
Danijel Martinek 756e36c720 refactor(work): move epic folders into docs/work/epics/ 
The previous layout placed epic folders directly under docs/work/
alongside prds/ and _system/. Tightening: epics now live in their
own docs/work/epics/ subfolder, peer to prds/ and _system/. Same
shape as the existing prds/ bucket.

Final docs/work/ layout:
  README.md
  prds/<slug>.prd.md
  _system/_state.json
  epics/<slug>/_epic.md + <story-folder>/_story.md

Renames (git mv preserves history):
- docs/work/binder-wrap-helper/
    -> docs/work/epics/binder-wrap-helper/
- docs/work/library-evaluation-policy/
    -> docs/work/epics/library-evaluation-policy/
- docs/work/ci-security-and-supply-chain/
    -> docs/work/epics/ci-security-and-supply-chain/

Tooling updates:
- state-builder.mjs walks workRoot/epics/ directly; SKIP_FOLDERS
  obsoleted (no more sibling folders to filter out).
- dispatch.mjs's findNextTask, tickStoryBulletInEpic, and
  flipEpicDoneIfAllStoriesDone all join with "epics" segment.
- prd-ship.mjs's deriveShippingCommits walks workRoot/epics/ and
  git-logs docs/work/epics/<epic>/.
- decomposer.prompt.md emits epics under docs/work/epics/<epic-id>/.
- handoff + grill-with-docs glossary references updated.
- Glossary entry for Epic updated.

Reserved future shape: when a task-tracker integration (ClickUp,
Linear) ships, the epics/ subfolder hosts <task-id>-<slug>/
folders. Today it just hosts bare slugs.
2026-05-14 21:21:51 +02:00

2.9 KiB
Raw Blame History

id, epic, title, type, status, feature, depends-on, blocks, created, updated
id epic title type status feature depends-on blocks created updated
08-reviewer-prompt-update ci-security-and-supply-chain Sandcastle reviewer prompt update technical-story done tooling
02-socket-integration
06-codeql-and-audit-signatures
09-ci-security-guide-and-docs
2026-05-14T18:59:12+02:00 2026-05-14T19:21:52.308Z

Goal

Extend .sandcastle/reviewer.prompt.md with a "CI security checks" section that instructs the reviewer agent to read Socket CI output and CodeQL findings via gh run view, and reject the slice with specific notes if any critical Socket finding or error-severity CodeQL finding is present.

Why

The sandcastle reviewer is the single composable gate for agent PRs (ADR-019 constraint). Without an explicit section, an agent reviewer has no machine-readable instruction to check Socket + CodeQL outputs and may approve a slice that introduced a flagged dependency or a static-analysis error. Landing this after Stories 02 + 06 ensures the reviewer references gates that actually exist in CI.

External dependency: library-evaluation epic story 06 (sandcastle reviewer prompt) must be complete — the reviewer prompt must exist and have the library-trace check section that this story composes with. That epic is marked done.

Done when

  • .sandcastle/reviewer.prompt.md has a "CI security checks" section added after the existing library-trace check section.
  • The section instructs the reviewer to: (a) run gh run view <run-id> --log (or equivalent) for the PR's check suite; (b) scan the output for Socket findings of severity critical — if found, reject with notes naming the finding and referencing the failure-mode hierarchy in docs/guides/ci-security.md; (c) scan the output for CodeQL findings of severity error — same rejection pattern.
  • The reviewer composes these checks with the existing library-trace presence check (both must pass for approval).
  • pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff all pass (prose-only change; no executable code).

In scope

  • .sandcastle/reviewer.prompt.md — new "CI security checks" section only; existing sections unchanged.

Out of scope

  • Automated tests for the reviewer prompt — it's a prose runbook for an agent; success is verified manually (PRD testing decisions).
  • Extending the reviewer for pnpm audit signatures step failures — those surface as standard CI job failures, already handled by the reviewer's existing "all CI checks must pass" instruction.

Tasks

  • Extend .sandcastle/reviewer.prompt.md with a "CI security checks" section after the library-trace check: instruct the reviewer to read gh run view output for Socket critical findings and CodeQL error findings, reject on either with notes naming the finding and citing docs/guides/ci-security.md failure-mode hierarchy; one commit, all gates pass.